[PATCH] vajpegdecoder: Validate that enough data is available for the current JPEG...

Gbp-Pq: Name CVE-2026-52719.patch

diff --git a/sys/va/gstjpegdecoder.c b/sys/va/gstjpegdecoder.c
index 2448c3cb5d23368ae5e2d044c0f244f237646a10..3fccf039052615336e0798b5a8adcfdb3a79832b 100644 (file)
--- a/sys/va/gstjpegdecoder.c
+++ b/sys/va/gstjpegdecoder.c
@@ -370,6 +370,18 @@ _get_marker_name (guint marker)
 }
 #endif
 
+static gboolean
+jpeg_segment_fits_input (const GstJpegSegment * seg, gsize size)
+{
+  if (seg->size < 0)
+    return FALSE;
+
+  if ((gsize) seg->offset > size)
+    return FALSE;
+
+  return (gsize) seg->size <= size - (gsize) seg->offset;
+}
+
 static GstFlowReturn
 gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
     GstVideoCodecFrame * frame)
@@ -399,6 +411,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
     if (!gst_jpeg_parse (&seg, map.data, map.size, offset))
       goto unmap_and_error;
 
+    if (!jpeg_segment_fits_input (&seg, map.size))
+      goto unmap_and_error;
+
     offset = seg.offset + seg.size;
     marker = seg.marker;
 
@@ -445,6 +460,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
           if (!gst_jpeg_parse (&seg_scan, map.data, map.size, offset))
             goto unmap_and_error;
 
+          if (!jpeg_segment_fits_input (&seg_scan, map.size))
+            goto unmap_and_error;
+
           if (seg_scan.marker < GST_JPEG_MARKER_RST_MIN
               || seg_scan.marker > GST_JPEG_MARKER_RST_MAX)
             break;